Hi all,
Pursuant to recent discussions, here is a draft design[1] that formalises and (as of initial draft) proposes some changes to FreeIPA's certificate revocation behaviours.
Nothing is set in stone. Every change is up for debate. There are some open questions (search for **TODO** and **QUESTION** in the document). The general idea is to eliminate inconsistency, redundancy, potential confusion, and command complexity in how revocation is handled in IPA, so that the commands and behaviours are easy for operators to understand.
With the creation of this design proposal and the corresponding ticket[2], the ticket and PR[3][4] that began the recent discussion have been closed.
[1] https://www.freeipa.org/page/V4/Certificate_revocation_behaviour_standardisa... [2] https://pagure.io/freeipa/issue/7580 [3] https://pagure.io/freeipa/issue/7482 [4] https://github.com/freeipa/freeipa/pull/1915
Thanks, Fraser
freeipa-devel@lists.fedorahosted.org